Elementor Website Builder cross-site scripting flaws

Summary

Malicious scripts can run in visitors' browsers through the Elementor Website Builder WordPress plugin. Versions 4.3.5 and older are affected.

What to do

Update to 4.3.6 or later.

Products and platforms

• Elementor Website Builder

CVE IDs

• CVE-2026-109883 (opens in a new tab)
• CVE-2026-109884 (opens in a new tab)
• CVE-2026-120850 (opens in a new tab)

Sources

• CVE record: cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab)

Times

First published 2026-11-06 12:09 UTC

First seen 2026-11-09 17:40 UTC